Slackware PATH Environment Variable Vulnerability
BID:184
Info
Slackware PATH Environment Variable Vulnerability
| Bugtraq ID: | 184 |
| Class: | Environment Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 02 1999 12:00AM |
| Updated: | Jan 02 1999 12:00AM |
| Credit: | This vulnerability was posted to Bugtraq by Steven Alexander ([email protected]) on Sat, 2 Jan 1999 12:36:28 -0800 . |
| Vulnerable: |
Slackware Linux 3.6 Slackware Linux 3.4 Slackware Linux 2.0.35 |
| Not Vulnerable: | |
Discussion
Slackware PATH Environment Variable Vulnerability
Slackware Linux uses an insecure PATH environment variable. It has been reported that the root users PATH variable contains an entry for the current working directory '.' as well as the '/usr/andrew/bin' directory. These entries pose a security threat, as it may be possible for an attacker to construct malicious executables, using the names of commonly used system commands, in a commonly used directory or the '/usr/andrew/bin' directory.
Slackware Linux uses an insecure PATH environment variable. It has been reported that the root users PATH variable contains an entry for the current working directory '.' as well as the '/usr/andrew/bin' directory. These entries pose a security threat, as it may be possible for an attacker to construct malicious executables, using the names of commonly used system commands, in a commonly used directory or the '/usr/andrew/bin' directory.
Exploit / POC
Slackware PATH Environment Variable Vulnerability
No exploit is required.
No exploit is required.
References
Slackware PATH Environment Variable Vulnerability
References:
References: